[FIP-49][gateway] Validate Gateway configuration, restrict Fluss client options, and redact secrets

[beryllw]

Search before asking

• I searched in the issues and found nothing similar.

Description

FIP-49 requires deterministic Gateway configuration and must prevent native-client options from bypassing Gateway-owned guarantees or exposing credentials. This task:

• adds flat dotted YAML configuration with documented file, environment-variable, and CLI precedence;
• adds typed server, security, request-limit, and per-cluster connection settings;
• validates supported client.* options, value ranges, conversions, and cross-field constraints before listeners bind or Fluss connections are created;
• prevents client options from disabling Gateway-owned acknowledgement, idempotence, and retry behavior;
• rejects a statically configured Fluss authorization identity because user mode supplies it per request;
• defines connection.service.account and connection.service.secret as the canonical service credential settings while retaining deterministic legacy last-wins overrides without rejecting them in this task;
• emits one redacted deprecation warning per affected cluster and redacts tokens, users, passwords, and service secrets from debug output, errors, and logs; and
• adds unit, property, and process tests for precedence, invalid configuration, client-option restrictions, warning behavior, and secret redaction.

Part of FIP-49.

Willingness to contribute

• I'm willing to submit a PR!